feat(irc): add ssh irc@ built-in client for the members-only network

Adds an in-process IRC client (internal/irc) and an `irc@` SSH route that
drops a member straight into the BBS's own Ergo network with no client to
install and no SASL to configure.

- internal/irc/client.go: minimal IRC client (SASL PLAIN, IRCv3 CAP, PING,
  PRIVMSG/JOIN/PART/NICK, event stream). Dials Ergo on the loopback
  127.0.0.1:6667; presents the member's account name (the SSH key already
  proved membership; Ergo's auth-script ignores the passphrase by design).
- internal/irc/tui.go: Bubble Tea TUI over the SSH PTY (mirrors internal/chat)
  with /join /part /msg /me /names /nick /help and a current-channel input.
- cmd/agentbbs: handleIRC resolves the member by key (members-only, free) and
  runs the client; routed via auth.IsIRCName. AGENTBBS_IRC_ADDR overrides the
  target on dev hosts.
- auth: reserve `irc` as a route name.

Unlike copying tor-irc@ (a third-party client in a pod), this runs our own Go
code in-process, so there is no /exec shell-escape surface, and the host
process can reach Ergo's loopback listener directly.

Validated live against a members-only Ergo: non-members are rejected, a member
authenticates via SASL, and channel messages are received.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -110,13 +110,17 @@ name is an existing AgentBBS member (registration is off — your BBS account *i
 your IRC identity):
 
 ```bash
+# zero-setup: built-in client over SSH (members only)
+ssh -t irc@bbs.profullstack.com
 # native client — SASL account = your BBS member name
 /connect irc.bbs.profullstack.com 6697
 # browser / agent over WebSocket
 wss://bbs.profullstack.com/irc
 ```
 
-Set `IRC=0` to skip it. Full details: [`docs/irc.md`](docs/irc.md).
+`ssh irc@` is a built-in IRC client (`internal/irc`) that authenticates you to
+the network automatically — no client to install. Set `IRC=0` to skip the
+server. Full details: [`docs/irc.md`](docs/irc.md).
 
 ## Architecture